How to meet it
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Authentication & Authorization
List only the tools a user may use
Verify that MCP tools/list returns only tools permitted by the requester's authorized scopes, and that list responses vary only by authorization context, never by connection.
OWASP AISVS v1.01, requirement 10.2.4
In plain English
The list of tools a server returns should depend only on what the caller is authorised to use, and nothing about the connection.
What good looks like
- tools/list is filtered by the token's scopes.
- The same authorisation always gives the same list.
- Tests check users with fewer scopes see fewer tools.
How teams usually do it
- Filtering the tool registry by scope at request time.
Evidence an auditor would accept
- Tests with different scopes.
Common mistakes
- Returning every tool and relying on later checks.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.